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Abstract 

This note presents a quantum protocol that demonstrates that weak coin flipping with bias « 0.239, 
less than 1/4, is possible. A bias of 1/4 was the smallest known, and followed from the strong coin 
flipping protocol of Ambainis j^j (also proposed by Spekkens and Rudolph ]To|| ). Protocols with yet 
smaller bias « 0.207 have independently been discovered j|, |Tl|] . We also present an alternative strong 
coin flipping protocol with bias 1/4 with analysis simpler than that of Q . A similar analysis for a class 
of cheating strategies has been given by [[To] . 

1 Quantum weak coin nipping 

Often in applications based on this primitive, coin-flipping is used to choose one of two competing parties 
as the "winner". In the classic example from ||, Alice and Bob are getting a divorce, and would like to 
decide who gets the car. They decide to toss a coin for that purpose, but don't trust each other. In such 
a scenario, they could instead play any fair game to decide the issue. Motivated by this, we consider the 
following weaker version of coin-flipping. 

A weak coin flipping protocol with bias e, is a two-party communication game in the style of in which 
the players start with no inputs, and compute a value ca,cb G {0,1} respectively or declare that the other 
player is cheating. The protocol is deemed successful if Alice and Bob agree on the outcome, i.e. ca = cb- 
Then, the outcome is identified with Alice winning, and 1 with Bob winning. The protocol satisfies the 
following additional properties: 



1. If both players are honest (i.e., follow the protocol), then they agree on the outcome of the protocol: 
ca = cb, and the game is fair: Pr(c^ = cb = b) = 1/2, for b £ {0, 1}. 

2. If one of the players is honest (i.e., the other player may deviate arbitrarily from the protocol in 
his or her local computation), then the other party wins with probability at most 1/2 + e. In 
other words, if Bob is dishonest, then Pr(c^ = cb = 1) < 1/2 + e, and if Alice is dishonest, then 
Pi(c A = c B = 0)< 1/2 + e. 
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In a strong coin nipping protocol, the goal is instead to produce a random bit which is biased away from 
any particular value or 1. Clearly, any strong coin flipping protocol with bias e leads to weak coin flipping 
with the same bias. We may also derive a strong coin-flipping protocol from a weak one. A simple way to 
do this is to have the winner of the game flip the coin. This results in an increase in the bias of the protocol, 
however: if when one player, say Alice, is dishonest, and the other (Bob) honest, the probability of Alice 
winning is p w > 1/2, and the probability of Bob winning is pi, then the coin will have bias p w + (pi — 1) /2. 

The primitive of quantum strong coin flipping has been studied in, e.g., (7|, ||, [I], ^, pX] . The best known 
protocol, with bias 1/4 = 0.25, is due to Ambainis 0], also independently proposed by Spekkens and 
Rudolph fi~Q|| . This note presents a protocol that demonstrates that weak coin flipping with bias ~ 0.239, 
less than 1/4, is possible. This protocol is obtained by modifying the protocol of [Q] especially so that 
the winning party is checked for cheating. We also describe a related strong coin flipping protocol with 
bias 1/4 that has the advantage over [Q] that the analysis is considerably simpler. A similar analysis for a 
class of cheating strategies has been given by []To| . 

Since the discovery of the abovementioned protocol, we have learnt of several exciting developments. 
Kitaev || has shown that in any protocol for strong coin flipping, the product of the probabilities with 
which each of the players can achieve outcome (say) 0, has to be at least 1/2. Hence the protocols with 
arbitrarily small bias are not possible; the bias is always at least 1/V2 — 1/2 ~ 0.207. (Previous lower 
bounds applied only to certain kinds of protocol [l(], M.) Furthermore, Ambainis Q and Spekkens 



and Rudolph [11] have constructed a family of protocols for weak coin flipping, where the product of the 
winning probabilities is exactly 1/2. By making the winning probabilities equal, they get protocols in which 
each player wins with probability at most 1/V2, and hence the bias is 1/V2 — 1/2 0.207. Subsequently, 
Ambainis Q proved a lower bound of 1/2 for the product of the winning probabilities for the specific class 
of protocols considered in [11 1. We note that the lower bound of Kitaev for strong coin flipping does not 



apply here and hence quantum games of the weaker variety with even smaller bias may be possible. 

2 A game with small bias 

Below, we describe a weak coin flipping game that has bias less than 1/4. The game is derived from the 
protocol of H|, which achieves the previously best known bias of 1/4. 

The protocol is parametrised by a £ [0,vr], which we will optimise over later. For x,s £ {0, 1}, define the 
state \tp XjS ) = |V>:r,s(aO) i* 1 a Hilbert space TLt = C 3 , and \ip x ) = \ip x (a)} E H s ® Tit = C 2 (g> C 3 as: 

ol ol 

\i> x , s ) = cos-|0) + (-l) s sin-[x + l) (1) 

m = -^(io)i^«,o) + ii>i^«,i». (2) 

The protocol has the following rounds: 

1. Alice picks a Gr {0, 1}, prepares the state \ip a } in TC S <g) Ti t (i.e., over one qubit and one qutrit) and 
sends Bob the right half of the state (the qutrit). 

2. Bob picks b Er {0, 1} and sends it to Alice. 

3. Alice then reveals the bit a to Bob. Let c = a © b. 
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If c = 0, then ca <— and she sends the other part of the state \ip a ) (the sign qubit). Bob checks 
that the qutrit-qubit pair he received in the first and the current rounds are indeed in state \ip a }- If 
the test is passed, Alice wins (cb <— as well), else Bob concludes that Alice has deviated from the 
protocol, and aborts. 

4. If, on the other hand, c = a© b = 1, then cb <— 1, and Bob returns the qutrit he received in round 1. 
Alice checks that her qubit-qutrit pair are in state \ip a ). If the test is passed, Bob wins the game 
(ca <— 0), else, Alice concludes that Bob has tampered with her qutrit to bias the game, and aborts. 

If the two players follow this protocol, the game is fair. We now analyse the situation where one of the 
players cheats. 

Lemma 2.1 If Bob is honest, then the probability that Alice wins Pr(ce = 0) < |(1 + cos 2 ^). 

Proof: We assume w.l.o.g. that a dishonest Alice tries to maximize her probability of winning, and 
therefore sends a = b (so that c = a © b = 0) in round 3. Her cheating strategy then takes the following 
form. Alice uses some ancillary space TC and prepares some state 6 7i®7i s ®7it- She keeps the part of 
the state in 7i ® 7i s and sends the qutrit part in 7i t to Bob. Let a denote the density matrix of Bob after 
the first round of the protocol (i.e., of the qutrit). Let p a be the density matrix he would have if Alice had 
prepared the honest state \tpa)'- 

' (y. cy. 

Pa = Tr Ha \*l> a ){M = 2(^0,0X^,0! + IVvX^M) = cos 2 - |0)(0| +sin 2 - |a + l)(a + l|. 

In the second round, Bob replies with a random bit b. So that she wins, Alice sends a = b to Bob and 
subsequently tries to pass his check. For that, she performs some unitary operation U on her part of the 
state, and gets \ip ) = (Ub © After that, she sends the part of the state in 7i s (the sign qubit) to 

Bob. The final joint state can be written now as 

i 

As we see, at the end of the protocol Bob has the density matrix Ob = YliPi\'&i,b)('4'i,b\- 

The probability that Alice wins the game is equal to the probability that she passes Bob's check at the 
end of the protocol, i.e. that Bob measures his part of the joint state and gets \ipb) as the outcome 

Pr[Alice wins | Bob sends b] = Pi\(ipb\'ipi,b)\ 2 

i 

= F{a b Mb){^b\) 

< F(Trn s (o- b ),Tr ns W b )(ip b \) 

= F(a,p b ), 

where F(-, •) is the fidelity of two density matrices. Here, we have used the fact that the fidelity between 
two states can only increase when we trace out a part of the states. Note also that the state Tr-^ s (<Tb) is 
equal to a, which is independent of b. 
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Finally we have, 



Pr[Alice wins] < -[F(a, p ) + F(a, pi)} 
< ±[i + y /F(po, Pl )] 

1 /-, 2 a \ 

= -(1 + cos -). 

The second inequality is due to [10, Lemma 2], |3, Lemma 3.2]. Also F( P o,pi) = II J~PqJ~P\ 



i2 
Itr 



cos 



4 a 
2 ■ 



,2 ii' 



This completes the proof. ■ 

Note that the analysis above is tight in the sense that Alice can cheat with probability equal to ^ (1+cos 2 2 ,. 
She does this by preparing the state |^o) + |V"i) (normalised) and sending the qutrit to Bob in the first 
round. In the third round, she sends a = b, and the sign qutrit from the above state. 

If Bob is the dishonest player, we can show the following bound. 



Lemma 2.2 // Alice is honest, then Pr(cA = 1) < ( ^= cos 2 ^ + sin 2 ^ 



Proof: A cheating Bob tries to infer the value of the bit a that Alice picked from the qutrit he receives 
in round 1 so that he can send b = a. However, he has to minimize the disturbance caused to the over 
all state \i/ja}- Suppose that Bob applies the unitary transformation U on TLt H <8> C 2 to the qutrit he 
receives from Alice, some ancillary qubits, and a qubit reserved for his reply, and that: 



U 



|i)|o)|o>^|<Mlo) + l<M|i>- 



(3) 



He measures the last qubit, and sends that across in round 2. If the XOR of the bit he sent and the one 
that Alice picked is 1 (i.e., b = a), in round 4 he sends one qutrit (the Tit part) from the above state across 
to Alice. 

Assuming that Alice had picked a, Bob's probability of winning is:[| 



<^(io>K'«+-f'^ 



< 



< 



< 



a 



a 



OL 

- |1> ( cos-|0 o ,s) 
a , 



(lpa,o\ (cOS-|(fo,a) +Sin-|</> a+ i i a)) +(V>a,ll COS 7rl<Ma) ~ SU1 — |0 a +l,a 



cos -(O|0 o ,a) + cos - sin -(0|^ a +l,a) + cos — sin -(a + l|0o,a) + sin —(a + l|<^ a +i,a) 



a 



a 



a 



a 



a 



a 



+ cos -(0|^ ,a) - cos -sin-(O|0 a+ i i a) - cos - sin -(a + l\4> ,a) + sin -(a + l|^ a +i 



cos -(0\<h,a,) + sin ~{a + l\(f) a+1} a) 

n OC .J . , ... q (X || ■ | , 

COS — || (O|0Q jS ) || +Sin — || (a + l|0 a +l,a) 



COS 



2 

2 a 

2 
a 



COS 



+ sin 



+ sin 



a 



a. 



'■>a+l,a 



1 In the following, for a vector |u) £ Tt, and a vector \v) G H ® /C, by {u\v) we will mean the projection of v under the 
operator \u){u\ ® I. 
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Now, consider Pr[Bob wins], which is the average of the above expression over a £ {0, 1}. This is maximised 
when || 00,0 || = || 4>o,i II = l/\/2 (recall from equation @ that || 4>o,o || 2 +|| ^0,1 || 2 = 1)- Thus, the probability 
of Bob winning is bounded by 



1 n a i a 

—= cos h sin — 

y/2 2 2 
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as claimed. 



There is a cheating strategy for Bob that achieves the above probability of success. Bob can use the 
following transformation on the qutrit he receives and an ancillary qubit: 

|0)|0) - |0)<g>i=(|0) + |l», and 
\x + l)\0) 1 ^ \x + l)\x), for x € {0,1}. 

He then measures the ancilla to get the bit 6 he is supposed to send in the second round. 

As we vary the parameter a from to ir Alice's cheating probability decreases from 1 to 1/2 and Bob's 
cheating probability increases from 1/2 to 1. The bias is minimized when the two probabilities are made 
equal: 

-(1 + cos 2 -) = (^cosS-W-j (4) 

By choosing a to satisfy the above equation, we get a protocol in which no player can win the game with 
probability greater than 0.739. The bias is then 0.239 < 1/4. 



3 A strong coin nipping protocol 

Finally, we present a variant of the strong coin flipping protocol of 0, which has the same bias, but is 
much more simple to analyse. The protocol has the following three rounds: 

1. Alice picks a Gr {0,1}, prepares the state \ip a ) G TL S (8> Ht as in equation (||) and sends Bob the 
qutrit. 

2. Bob picks b Er, {0, 1} and sends it to Alice. 

3. Alice then reveals the bit a to Bob and sends the second half of the state \tp a ). Bob checks that the 
qutrit-qubit pair he received are indeed in state \tp a )- If the test is passed, Bob accepts the outcome 
c = a © b, else Bob concludes that Alice deviated from the protocol, and aborts. 

The analysis for Bob's cheating strategy is the same as in @ and his cheating probability is at most 

* + " P ° ~ Pl " tr = i(l + sin^). 
2 4 2 V 2 J 



The analysis for Alice's cheating strategy is the same as in Lemma 2.1 above, and the same bound of + 



cos 2 if) holds here as well. This analysis is considerably simpler and does not require the symmetrization 



2 

in [01 for the state sent in the first round. 
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By making the two cheating probabilities equal 



1 . 9 a. 1 . 9 a 

-(1 + cos -) = - 1 + sin 2 - 



we achieve the bias of 1/4 for a = tt/2. 
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